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Agilent Docket No. 10010022 

CORRELATION AND ENRICHMENT OF 
TELEPHONE SYSTEM CALL DATA RECORDS 



5 FIELD OF THE INVENTION 

The present invention relates generally to telephone systems and, more 
particularly, to the correlation of calling records. 

10 

BACKGROUND OF THE INVENTION 

1. Introductory Remarks: 

In the telephone system post-divestiture environment, complex regulatory tariffs 
1 5 have been mandated and/or inter-carrier contracts have been negotiated between carriers 
which (a) regulate the way in which traffic is to be routed between them and (b) specify 
the rates at which various types of traffic are to be charged. It is often of financial 
advantage to mis-route calls in violation of these existing regulatory tariffs and/or 
established inter-carrier contracts. The common name for this manipulation is 
20 "arbitrage". The intent of those perpetrating this mis-routing is to take advantage of 
lower rates associated with the delivery of telephone traffic via other than the proper 
routes. Confirming the presence of arbitrage and proper billing is often difficult due to 
the fact that call routing information is often missing or incomplete. 

25 2. Definitions: 

In general, the following definitions are common in the telephone industry, but 
are included herein for completeness and clarity of explanation. They define the 
meanings of these terms as used in the Present Patent Document. 



30 Access Traffic - 

A compensation mechanism governed by tariffs and/or contracts for message traffic 
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carried by interexchange carriers (IXC) and exchanged between the IXC's and local 
exchange carriers (LEC's), independent local exchange carrier (ILEC's), and competitive 
local exchange carrier (CLECs). This type of traffic is generally carried over a type of 
telephone trunk called a Feature Group D trunk or FG-D trunk, and typically carries the 
5 highest per-minute charge. Under access traffic, IXC's pay the other carriers for each 
Minute of Use (MOU) of traffic destined to the IXC or originating from the IXC. 

ACM timestamp - 

The time at which the telephone being called began alerting the user (e.g. ringing). 

10 

Address Complete Message (ACM) - 

The Address Complete Message (ACM) is used to acknowledge receipt of an initial 
address message (IAM) and to indicate that the called party is being alerted (e.g. via 
ringing). 

15 

ANM timestamp - 

The time the operator of the telephone being called answered the telephone. 

Answer Message (ANM) - 

20 The Answer Message (ANM) is used to indicate that the user called has answered, end 
to end connection is established, and a conversation takes place. 

Arbitrage - 

As used herein and as commonly used in the telephone industry, it is the mis-routing of 
2 5 inter-carrier telephone calls in such a way as to violate existing regulatory tariffs and/ or 
established inter-carrier contracts. The purpose of such mis-routing is typically to take 
advantage of lower rates associated with the delivery of telephone traffic via routes other 
than those established and required by such tariffs and contracts and as such may be 
fraudulent. Arbitrage typically occurs via the following techniques: (1) interexchange 
30 carrier (IXC) access traffic delivered via competitive local exchange carriers (CLECs) 
and (2) transit traffic delivered via non-transit trunks 



2 
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Backward Interwork Parameter - 

An indicator as to whether Signaling System 7 (SS7) and non-SS7 inter-working was 
encountered ahead of this point in the call. 

5 Call Detail Record (CDR) - 

A collection of messages comprising parameters and time-stamps associated with each 
call which provide detail regarding the call origin, destination, and other details. 

Called Number - 

10 The telephone number dialed by the calling user. 

Calling Number - 

The telephone number of the user making the call. 

15 Carrier Identification Code (CIC) - 

Parameters contained within the Signaling System 7 (SS7) Initial Address Message 
(IAM) message which can be used to identify the requested interexchange carrier (IXC). 

Carrier Identification Code Parameter - 

20 The number identifying the interexchange carrier (IXC) selected by the Local Exchange 
Carrier. 

Charge Number - 

The telephone number to which the call is charged. Typically it is the telephone number 
25 of the calling telephone. 

Competitive Local Exchange Carriers (CLEC) - 

A local exchange carrier (LEC) but specifically referring to one that competes with the 
incumbent local exchange carrier (LEC). 

30 

Destination Point Code (DPC) - 
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The Signaling System 7 (SS7) node [e.g switching office or Signaling Transfer Point 
(STP)] that the message is being sent to. 



eo - 

5 A switching office normally referred to as an end office or "eo" to which telephones 
(from homes or businesses) are connected via wires called "loops". 

Feature Group D Trunk (FG-D Trunk) - 

A type of telephone trunk. See Access Traffic. 

10 

Forward Interwork Parameter - 

An indicator as to whether Signaling System 7 (SS7) and non-SS7 inter-working was 
encountered prior to the point in the call where the parameter is observed. 

15 IAM timestarap - 

The time the trunk was seized for transmission of an SS7 message. 

Independent Local Exchange Carriers (ILEC) - 

Generally refers to a local exchange carrier (LEC) which co-existed with a local 
20 exchange carrier owned by the Regional Bell Operating Companies. 

Initial Address Message (IAM) - 

The Initial Address Message (IAM) is used to indicate the desire to set up a call. A trunk 
is seized and "reserved" for use in the call. 

25 

Interconnect Carrier - 

Any carrier that interconnects with the local exchange carrier (LEC). 

Interexchange Carriers (IXC) - 

30 An interexchange carrier (IXC) transports calls from one local exchange carrier (LEC) 
to another, or possibly the same LEC, throughout the IXC's serving area. The IXC's 
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serving area would typically span more than one local access transport area (LATA), and 
the IXC receives messages from and delivers messages to local exchange carriers 
(LEC's, CLECs, and ILEC's) and other interchange carriers (IXC's). Calls that span 
local area transport areas (LATA's - geographical regions defined at divestiture) typically 
5 must use an IXC. 

IXC Trunk - 

A trunk that comes from an interexchange carrier to a local exchange carrier. 

10 Jurisdiction Indicator Parameter - 

A parameter contained in SS7 messages which, if available, indicates the geographic 
origin of a call. 

Link Monitoring System (LMS) - 

15 A system that can be used to collect Call Detail Records (CDR's) by monitoring SS7 
links. 

Local Access Transport Area (LATA) - 

The geographic area within which a local exchange carrier (LEC) provides service is 
20 typically divided into various areas referred to as local access transport areas (LATA's). 

Local Exchange Carrier (LEC) - 

A local exchange carrier (LEC) is a telephone service provider that provides telephone 
service to its customers in a specific geographical serving area. A local exchange carrier 
25 (LEC) would typically be a local telephone company. 

Local Exchange Routing Guide (LERG) - 

A document defining the specific local access transport area (LATA) within which a 
given telephone number is located. 

30 

Location Routing Number (LRN) - 
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A number obtained from the database at the service control point (SCP). The SCP 
converts the called number into the LRN which is the number used by the network to 
get the call to its final destination. 

5 Loop - 

Telephones are connected (from homes or businesses) via wires called "loops" to a 
switching office normally referred to as an end office or "eo". 

Meet-Point Billing - 

10 Traffic exchanged between interexchange carriers (IXC's) and independent local 
exchange carriers (ILEC's) destined for local exchange carrier (LEC) customers (in cases 
where the IXC does not directly interconnect with the LEC) is governed by tariffs and/or 
contracts, using a compensation mechanism referred to as meet-point billing. Under 
meet-point billing, IXC's pay 

15 the ILEC a fee, part of which is subsequently paid by the ILEC to the LEC for each 
Minute of Use (MOU) of traffic between the IXC and the LEC. 

Minute of Use (MOU) - 

For billing purposes a measure of the time which a given carrier's resources are 
20 consumed providing a given service. 

Numbering Plan Address (NPA) - 

More commonly known as the area code of the telephone number. 
25 NPANXX - 

The numbering plan address (i.e., the area code) plus the next three digits of the 
telephone number. 

Originating Point Code (OPC) - 

30 The Signaling System 7 (SS7) node [e.g. switching office or Signaling Transfer Point 
(STP)] that is sending the message. 

6 
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Reciprocal Compensation - 

Under reciprocal compensation, carriers pay each other a usage fee for each Minute of 
Use (MOU) of traffic delivered from their network to the other carrier's network. This 
5 message traffic is typically traffic exchanged between various local exchange carriers 
(LEC's) and their competitive local exchange carriers (CLECs) and independent local 
exchange carriers (LEC's). This type of traffic is generally carried over a type of 
telephone trunk called a local trunk. 

10 Release Complete Message (RLC) - 

The Release Complete Message (RLC) is sent when the second of the two connected 
parties hangs up. At that point the trunk is released. 

Release Message (REL) - 

1 5 The Release Message (REL) indicates that the first of the two connected parties has hung 
up. 

REL times tamp - 

The time the operator of the first telephone to hang up did so. 

20 

Remote Site Processors - 

A device used to consolidate partial Call Detail Records (CDR's) into complete CDR's. 

RLC timestamp - 

25 The time the operator of the second telephone to hang up did so. 

Service Control Point (SCP) - 

A network database used to translate called numbers into local routing number which 
translates the called number in the location routing number (LRN). 

30 

Signaling Transfer Points (STP's) - 
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At the heart of the SS7 network are packet switches known as Signaling Transfer Points 
(STP's). STP's are deployed in pairs in the North American SS7 network to provide 
communication path redundancy. Different carriers own a portion of the SS7 network 
and interconnect their end offices (eo's) and tandem's to the overall SS7 network so as 
5 to enable end-to-end communication between carriers. 

SS7 Links - 

The communication links over which Signaling System 7 (SS7) traffic is carried. 

10 SS7 Network - 

The Signaling System 7 (SS7) messages are transported over a secure data network 
referred to as the "SS7 network". The SS7 network comprises various SS7 Links along 
with Signaling Transfer Points (STP's). 

15 SS7 Protocol - 

To perform the task of call setup and tear down when multiple end offices (eo's) are 
involved, switching offices communicate with each other using a signaling protocol 
referred to as Signaling System 7 (SS7), carried over SS7 links. SS7 messages are used 
in specific sequences to perform various tasks required to establish telephone 
20 connections. Telephone calls between two customers connected to the same eo will be 
handled by the application logic contained in the eo, and will not require the use of the 
SS7 protocol. 

Tandem - 

25 In certain cases, for example two towns that are somewhat far apart, a type of switching 
center called a "tandem" is involved in establishing connectivity between two customers. 

TCIC- 

Trunk Circuit Identification Code. Between any two telephone switches there may a 
30 trunk group which comprises several trunks. These trunks are identified via the TCIC. 

8 
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Transit Network Selection (TNS) - 

Parameters contained within the Signaling System 7 (SS7) Initial Address Message 
(IAM) message which can be used to identify the requested interexchange carrier (IXC). 

5 Transit Traffic - 

Traffic that goes thru a LEC network but does not originate or terminate in that LEC and 
uses trunks other than those specifically designated for such traffic. 

Trunk - 

10 When telephones are served from different eo's (e.g. in different towns), they are 
interconnected via wires called "trunks" between the eo's. 

Wide Area Network (WAN) - 

A communication network serving a large geographical area of interest. 

15 

4. Discussion: 

Previous methods for the determination of telephone traffic routing have been 
based upon a single call sample, e.g. a call record obtained at the point where the call 
originates or at the point where the call terminates. The information available within a 

20 single call record has limitations due to the fact that critical routing information may be 
(a) missing or (b) incorrect. These techniques have proven to be ineffective at 
determining the presence of arbitrage. Since in typical arbitrage situations, the local 
exchange carrier is under billing the interexchange carriers, there is a great financial 
incentive for the local exchange carrier to detect and stop arbitrage, and since previous 

25 methods are both unreliable and labor intensive, there is a great need for improved means 
for detecting arbitrage. 
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SUMMARY OF THE INVENTION 



The present patent document discloses novel methods for the correlation of 
calling records and for the detection of mis-routing of traffic in a telephone or other 
5 communication system. Previous methods for detection of mis-routing have been based 
upon a single call sample, e.g. a call record obtained at the point where the call originates 
or at the point where the call terminates. The information available within a single call 
record has limitations due to the fact that critical routing information may be (a) missing 
or (b) incorrect, and these techniques have proven to be ineffective at determining the 

10 presence of arbitrage. Correlation of call detail records obtained from various 
communication segments provides the ability to mutually enrich the records so as to 
increase billing accuracy as well as to enhance the detection of call mis-routing. 

Techniques disclosed in the present patent document can be used to identify inter- 
carrier telephone calls that are being mis-routed in such a way as to violate existing 

15 regulatory tariffs and/or established inter-carrier contracts The common name for this 
manipulation is "arbitrage", and the intent of the perpetrators is to take advantage of 
lower rates associated with the delivery of telephone traffic via routes other than those 
legislated or contracted. Through the process of correlation in representative 
embodiments, various call "legs" associated with the same call can be identified, and a 

20 more accurate "compound" call record can be made that incorporates call routing 
information obtained from the individual call legs. 

In a representative embodiment, a basic approach to arbitrage detection 
is to correlate inbound calls from a competitive local exchange carrier (CLEC) to a local 
exchange carrier (LEC) with the corresponding outbound calls at their point of origin. 

25 Correlation can be obtained via a variety of data obtained from call detail records in the 
SS7 network. 

The correlation feature of the link monitoring system (LMS) is the primary tool 
used to implement arbitrage detection. Call detail records (CDR's) are collected 
throughout the LEC footprint and "correlated' at the time of their load into the call detail 
30 record database. The correlation method comprises identifying call segments via call 
detail records wherein (1) the called station numbers are identical and (2) the time of call 
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initiation and the time the first party hangs up match within a configurable, but very 
small, time difference. The correlation method typically applies different time thresholds 
depending upon whether the call segments being correlated are deemed to be adjacent 
(e g. on either side of a tandem), or non-adjacent (e.g more than two tandems away from 
5 each other). 

In order to eliminate false correlations (i.e., to disassociate call segments that 
really are not related to the same call), attempts are made to increase the correlation 
confidence by correlating other pieces of call setup information from the various call 
segments. Specifically, further efforts can be made to (1) confirm that the time the 
10 connection for the call was completed matches within a configurable, but very small, 
time difference, (2) insuring that the calling number information parameters match, (3) 
insuring that charge number information parameters match, and/or (4) insuring that 
jurisdiction information parameters match. 

Additional constraints can be applied to select calls that fit the criteria of 
15 arbitrage, and to exclude calls that may be correlated for other legitimate reasons or 
duplicate call segments that may have been collected due to over-provisioning of the link 
monitoring systems. 

A measure of the probability of arbitrage is based upon the combinations of 
characteristics that are present. Once suspected, SS7 call detail records are randomly 
20 chosen and compared with billing records to confirm arbitrage. Once arbitrage is 
confirmed, the characteristics of known arbitrators can be further refined. Traffic 
profiles of carriers can be created that contain historical traffic information. Arbitrage 
may be suspected whenever the traffic profiles of two or more carriers change in ways 
inversely proportional to each other, suggesting the redirection of traffic from one carrier 
25 to another. Once suspected, SS7 call detail records can be analyzed in further detail to 
confirm the arbitrage 

Other aspects and advantages of the present invention will become apparent from 
the following detailed description, taken in conjunction with the accompanying drawings, 
illustrating by way of example the principles of the invention. 

30 
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BRIEF DESCRIPTION OF THE DRAWINGS 



The accompanying drawings provide visual representations which will be used 
to more fully describe the invention and can be used by those skilled in the art to better 
5 understand it and its inherent advantages. In these drawings, like reference numerals 
identify corresponding elements and: 

Figure 1A is a drawing of a telephone or similar communication system as 
described in various representative embodiments of the present patent document. 

Figure IB is a drawing of the telephone or similar communication system in 
1 0 preparation for call connection as described in various representative embodiments of the 
present patent document. 

Figure 1C is a drawing of the telephone or similar communication system with 
call connection complete as described in various representative embodiments of the 
present patent document. 

15 

Figure ID is a drawing of the telephone or similar communication system with 
one party disconnected as described in various representative embodiments of the present 
patent document. 

Figure IE is a drawing of the telephone or similar communication system 
20 immediately following last party disconnect as described in various representative 
embodiments of the present patent document. 

Figure IF is a drawing of the telephone or similar communication system after 
trunk release as described in various representative embodiments of the present patent 
document. 

2 5 Figure 2 A is another drawing of the messaging system of the telephone or similar 

communication system as described in various representative embodiments of the present 
patent document. 

Figure 2B is yet another drawing of the messaging system of the telephone or 
similar communication system as described in various representative embodiments of the 
30 present patent document. 

Figure 2C is a flowchart for separation of call data records in the telephone or 
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similar communication system as described in various representative embodiments of the 
present patent document. 

Figure 2D is a drawing of a system for accumulating call detail records into a 
central data repository. 

5 Figure 2E is a flow chart of a representative method for detection of arbitrage in 

the telephone or similar communication system as described in various representative 
embodiments of the present patent document. 

Figure 3A is a drawing of a representative example of call routing in the 
telephone or similar communication system without arbitrage as described in various 
1 0 representative embodiments of the present patent document. 

Figure 3B is a drawing of a representative example of call routing in the 
telephone or similar communication system with arbitrage as described in various 
representative embodiments of the present patent document. 

Figure 4 is a flow chart of a method for correlating call detail records as described 
1 5 in various representative embodiments of the present patent document. 

Figure 5 is a flow chart of additional method steps for correlating call detail 
records as described in various representative embodiments of the present patent 
document. 

Figure 6 is a flow chart of a method for establishing a probability of arbitrage in 
20 the telephone or similar communication system as described in various representative 
embodiments of the present patent document. 

Figure 7 is a flow chart of another method for establish the probability of 
arbitrage in the telephone or similar communication system as described in various 
representative embodiments of the present patent document. 

25 
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DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS 



As shown in the drawings for purposes of illustration, the present patent 
document discloses novel methods for the correlation of calling records and for the 

5 detection of mis-routing of traffic in a telephone or other communication system. 
Previous methods for detection of mis-routing have been based upon a single call sample, 
e.g. a call record obtained at the point where the call originates or at the point where the 
call terminates. The information available within a single call record has limitations due 
to the fact that critical routing information may be (a) missing or (b) incorrect, and these 

10 techniques have proven to be ineffective at determining the presence of arbitrage. 
Correlation of call detail records obtained from various communication segments 
provides the ability to mutually enrich the records so as to increase billing accuracy as 
well as to enhance the detection of call mis-routing. In the following detailed description 
and in the several figures of the drawings, like elements are identified with like reference 

15 numerals. 

1. Introductory Comments: 

Techniques disclosed in the present patent document can be used to identify inter- 
carrier telephone calls that are being mis-routed in such a way as to violate existing 

20 regulatory tariffs and/or established inter-carrier contracts The common name for this 
manipulation is "arbitrage", and the intent of the perpetrators is to take advantage of 
lower rates associated with the delivery of telephone traffic via other routes. Through 
the process of correlation in representative embodiments, various call "legs" associated 
with the same call can be identified, and a more accurate "compound" call record can be 

25 made that incorporates call routing information obtained from the individual call legs. 
Other techniques disclosed herein can be used to correlate call data records created in 
one part of the network with call detail records created in another part. Such techniques 
have application in calling traffic, detection of call mis-routing, and call billing. 

30 2. The Telephone System Environment: 

A local exchange carrier (LEC) operates in and serves individual telephone 
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subscribers in a specific geographical serving area. The serving area is typically divided 
into Local Access Transport Areas (LATA's). The LEC interconnects to competitive 
local exchange carriers (CLECs), Independent local exchange carriers (ILEC's) and 
Interexchange Carriers (IXC's) throughout its serving area. 
5 Traffic exchanged between IXC's and LEC's/ILEC's/CLEC's is governed by 

tariffs and/or contracts, using a compensation mechanism referred to as access traffic. 
Under access traffic, IXC's pay the other carriers for each Minute of Use (MOU) of 
traffic destined to the IXC or originating from the IXC. This type of traffic is generally 
carried over a type of telephone trunk called a Feature Group D trunk or FG-D trunk, and 

10 typically carries the highest per-minute charge. 

Traffic exchanged between CLECs and LEC's and between ILEC's and LECs 
is typically governed by tariffs and/or contracts, using a compensation mechanism 
referred to as reciprocal compensation. Under reciprocal compensation, carriers pay each 
other a usage fee for each Minute of Use (MOU) of traffic delivered from their network 

15 to the other carrier s network. This type of traffic is generally carried over a type of 
telephone trunk called a local trunk. 

Traffic exchanged between IXC's and ILEC's destined to LEC customers (in 
cases where the IXC does not directly interconnect with the LEC) is governed by tariffs 
and/or contracts, using a compensation mechanism referred to as meet-point billing. 

20 Under meet-point billing, IXC's pay the ILEC a fee, part of which is subsequently paid 
by the ILEC to the LEC for each Minute of Use (MOU) of traffic between the IXC and 
the LEC. 

3. Overview of Telephony, SS7, and Call Detail Records: 

25 

3.1 Basic Telephony 

Telephones are connected (from homes or businesses) via wires called "loops" 
to a switching office normally referred to as an end office or "eo". Telephone calls 
between two customers served by the same eo is handled by the application logic 
30 contained in the eo and will not require the use of the SS7 protocol described in the 
following. 
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When telephones are served from different eo's (e.g. in different towns), they 
must be interconnected via wires called "trunks" between the eo's. This type of 
telephone call will require inter-office coordination, usually via a networking protocol 
called SS7. 

5 In certain cases, for example two towns that are somewhat far apart, another type 

of switching center called a "tandem" is also involved in establishing connectivity 
between two customers. 

To satisfy various regulatory requirements, telephone carriers are classified as 
either "exchange carriers" (e.g., CLECs) or "interexchange carriers" (e.g. IXC's). Calls 

10 that span Local Area Transport Areas must use an interexchange carrier. 

To perform the task of call setup and tear down (when multiple eo's are involved), 
switching offices communicate with each other using a signaling protocol referred to as 
Signaling System 7 (SS7), carried over SS7 links. SS7 messages are used in specific 
sequences to perform various tasks required to establish telephone connections. The SS7 

1 5 messages are transported over a secure data network separate from the telephone call 
connection and referred to as the "SS7 network". At the heart of the SS7 network are 
packet switches known as Signaling Transfer Points (STP' s). STP's are deployed in pairs 
in the North American SS7 network to provide communication path redundancy. 
Different carriers own a portion of the SS7 network, and interconnect their eo's and 

20 tandem's to the overall SS7 network to enable end-to-end communication between 
carriers SS7 messages consist of a message type and associated parameters. In a 
representative embodiment, figures 1A-1F below illustrate the use of SS7 in the basic 
setup and tear down of telephone calls. For clarity of illustration, the configuration 
described in figures 1A-1F only comprises two eo's. The example is intended for 

25 illustrative purposes only. Other switching points and communication lines could be 
involved in any given connection between two stations. 

Figure 1 A is a drawing of a telephone or similar communication system 100 as 
described in various representative embodiments of the present patent document. Figure 
IB is a drawing of the telephone or similar communication system 100 in preparation for 

30 call connection as described in various representative embodiments of the present patent 
document. Figure 1 C is a drawing of the telephone or similar communication system 100 
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with call connection complete as described in various representative embodiments of the 
present patent document. Figure ID is a drawing of the telephone or similar 
communication system 100 with one party disconnected as described in various 
representative embodiments of the present patent document. Figure IE is a drawing of 
5 the telephone or similar communication system 100 immediately following last party 
disconnect as described in various representative embodiments of the present patent 
document. Figure IF is a drawing of the telephone or similar communication system 100 
after trunk release as described in various representative embodiments of the present 
patent document. 

10 In figure 1 A a first station 105, also referred to herein as a calling station 105 and 

as a calling telephone 105, is connected via a first loop 110 to a first switching office 
115, also referred to herein as a first end office 115 and as a first eo 115. A second 
station 106, also referred to herein as a called station 106 and as a called telephone 106, 
is connected via a second loop 111 to a second switching office 116, also referred to 

15 herein as a second end office 116 and as a second eo 116. First and second switching 
offices 115,116 are connected to each other via a number of trunks 120. Two redundant 
signaling systems 130, comprise signal links 135, and transfer points 140. In modern 
telephone systems, signaling systems 130 are Signaling System 7 (SS7) networks 130, 
signal links 135 are SS7 links 135, and transfer points are signaling transfer points 

20 (STP's) 140. For clarity, identifying numeral 130 is not shown in the figure 1 A but is 
understood to comprise the aforementioned elements. As previously mentioned, one or 
both of the signaling systems 130 is used for the passing of messages necessary to 
complete a connection between the calling station 105 and the called station 106. 

In figures IB- IF, one of the redundant signaling systems 130 has been removed 

25 as an to aid in clarity of illustration. 

In figure IB, a first message 150, which in the SS7 system 130 is referred to as 
an initial address message (IAM) 150 and also herein as a call initiation signal 150, is 
sent from the first switching office 115 via signal links 135 and transfer point 140 of 
signaling system 130 to the second switching office 116 to indicate the desire to set up 

30 a call. Trunk 120 is then seized by the first switching office 115 and "reserved" for use 
in the call. Connection between calling station 105 and first switching office 115 (i.e., 
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first loop 110), as well as the trunk 120 seized to connect first and second switching 
offices 115,116 is indicated in figure IB by bold lines. A second message 155, which 
in the SS7 system 130 is referred to as address complete message (ACM) 155, is sent 
from the second switching office 116 via signal links 135 and transfer point 140 of 
5 signaling system 130 to acknowledge receipt of the I AM 150 and to indicate that the 
called station 106 is being alerted (e.g., via ringing). 

In figure 1C, a third message 160, which in the SS7 system 130 is referred to as 
an answer message (ANM) 160, is sent from the second switching office 116 via signal 
links 135 and transfer point 140 of signaling system 130 to the first switching office 115 

10 to indicate when the called station 106 has answered. End to end connection is then 
established, and a conversation can take place. Connection between calling station 105 
and first switching office 115 (i.e., first loop 110), between first and second switching 
offices 115,116 via the trunk 120, and between second switching office 116(i.e., second 
loop 111) and called station 106 is indicated in figure 1C by bold lines. 

15 In figure ID, a fourth message 165, which in the SS7 system 130 is referred to 

as a release message (REV) 165, is sent from one of the switching offices, in this 
example the first switching office 115 via signal links 135 and transfer point 140 of 
signaling system 130 to the second switching office 116 to indicate that one of the 
parties, in this example calling station 105, has disconnected from the established 

20 communication link. In other words, the calling station 105 hung up. Connection 
between first and second switching offices 1 15,1 16 via the trunk 120 and between second 
switching office 116 (i.e., second loop 111) and called station 106 is indicated in figure 
ID by bold lines. 

In figure IE, a fifth message 170, which in the SS7 system 130 is referred to as 
25 a release complete message (RLC) 170, is sent from one of the switching offices, in this 
example the second switching office 116 via signal links 135 and transfer point 140 of 
signaling system 130 to the first switching office 115 to indicate that one of the parties, 
in this example called station 106, has disconnected from the established communication 
link. Again in other words, the called station 106 hung up. Connection between first and 
30 second switching offices 115,116 via the trunk 120 is indicated in figure IE by bold 
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lines. At that point the trunk 120 is released as indicated in figure IF. 



PATENT 



3.2 SS7 Messages: 

Signaling transfer points 140 in the SS7 network 130 transport the SS7 messages 
5 along with various parameters used though-out the call set up process to not only produce 
the desired connections, but also to enable all the switching offices involved to obtain 
measurements that can later be used to accurately bill the customers involved. Table 1 
identifies key parameters comprising call detail records T100. Call detail records T100 
are also referred to herein as CDR's T100, data records T100 and as records T100. Of 

10 particular interest in Table 1 are (1) the calling number T110 of the user (station) making 
the call, (2) the charge number T120 of the user (station) making the call, (3) the SS7 
node that is sending the message T130, also referred to herein as jurisdiction information 
parameter T130, (4) a forward interworking parameter T140, (5) the backward 
interworking parameter T150, (6) the SS7 node that the message is being sent to T160, 

1 5 also referred to herein as carrier identification code T160, and (7) the number dialed by 
the user T170. 

Certain timestamps associated with the dates and times at which each SS7 
message is detected are also recorded as shown in Table 2. Of particular interest in Table 
2 are (1) an initial address massage (IAM) timestamp T210, also referred to herein as 
20 first timestamp T210, (2) a release message (REL) timestamp T220, also referred to 
herein as second timestamp T220, and (3) an answer message (ANM) timestamp T230, 
also referred to herein as third timestamp T230. 

3.3 Call Detail Records (CDR's): 

25 The parameters and time-stamps associated with each message or collection of 

information referred to as the call detail record T100, as shown in Tables 1 and 2, are the 
primary pieces of information needed to determine who called whom, how the call was 
routed and what the call disposition was. 

For the illustrative purposes of this description, we will ignore other parameters 

30 that are used to handle more complex telephony services such as: Operator assisted calls, 
forwarded calls, 800 service, Local Number Portability, etc 
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The following discussion describes the functionality and mechanisms relating to 
the matching of records T100 relating to the same underlying telephone call. This 
matching of records T100 has applications in traffic routing analysis, interconnection 
billing, and the detection of mis-routed traffic or arbitrage. For example, in call routing 
5 analysis the records T100 can be used to identify the path of calls through a network 
100. It can be used to relate a call flowing between multiple networks, e.g. leaving a 
local network flowing through an external network and reappearing at the same or 
another local network. For call routing efficiency, as well as billing purposes and 
arbitrage detection, it is important to identify the route that the call followed. 

10 

3.3.1 Call Detail Record Correlation Techniques: 

In a representative embodiment, call detail records (CDR's) T100 are specified 
as being correlated based upon criteria comprising the following elements: (1) a 
combination of time differences between potentially related events observed at different 

15 points in the network which can differentiate between alternate paths through the 
network (e.g., single tandem, multiple tandem, internetwork call), (2) partial and full 
addressing parameter matching (such as a called telephone number T170), (3) 
identification of calls traversing a single switch by a common point code in the 
destination and originating point codes T160,T130 of two records T100, and (4) use of 

20 additional fields to increase confidence of record matching (e.g,.using calling and 
charging number matching). From the above items a correlation confidence is obtained 
which can be used to indicate the degree of similarity of call leg records T100 which 
could be used, for example, to overcome the masking techniques employed to bypass 
access charges such as masking part of all of the calling and/or charge party identifiers 

25 T110,T120 or though the introduction of a new/altered partial or full calling and/or 
charge identities. 

3.3.2 Duplicate Call Detail Records: 

Duplicate records T100 are defined to be two or more call records T100 relating 
30 to the same call leg between any two directly connected network element nodes. These 
are detected based on the presence of matching point code (originating T130 and 

20 
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destination T160) and identical trunk circuit identifiers in addition to the event 
timestamps closely matching. 



3.3.3 Data Enrichment of Call Detail Records: 

5 Using related call records T100, fields can be copied forward to earlier related 

records T100 to indicate information added as the call traversed a network 100 - e.g. to 
indicate to earlier related call records T100 the ultimate destination of a call. Or can be 
used to compensate for data that has been inadvertently or intentionally lost/masked in 
later related call records T100 by copying that masked data from earlier related call 

10 records T100. Specifically, (1) the calling number T110 can be copied into later related 
call leg records T100 to indicate the true origination of a call. This can be employed for 
improved billing accuracy and detection of access charge bypass (arbitrage) and (2) the 
local routing number (LNP) of a "dumped" or pre-translated ported call can be copied 
back to earlier call legs of the same call which may have been prior to the LNP 

1 5 query/translation, this enables the ultimate destination to be available to earlier records. 

Figure 2A is another drawing of the messaging system of the telephone or similar 
communication system 100 as described in various representative embodiments of the 
present patent document. In the representative embodiment of figure 2 A, a first signaling 
path segment 261 is connected to a first signaling transfer point 271 indicated in figure 

20 2A as SI; the first signaling transfer point 271 is connected to a second signaling path 
segment 262; the second signaling path segment 262 is connected to a second signaling 
transfer point 272 indicated in figure 2 A as S2; the second signaling transfer point 272 
is connected to a third signaling path segment 263; the third signaling path segment 263 
is connected to a third signaling transfer point 273 indicated in figure 2 A as S3; and the 

25 third signaling transfer point 273 is connected to a fourth signaling path segment 264. 
In the SS7 network 130, the signaling path segments 261,262,263,264 are used to 
transport messages or signals required by the telephone system 1 00 to connect the calling 
station 105 to the called station 106, thereby completing the call and permitting 
communication between calling station 105 and called station 106, as well as to 

30 subsequently disconnect the call. Signaling transfer points 271,272,273 route the call 
messages to the appropriate signaling path segments 261 ,262,263,264. Copies of the call 
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records T100 created during call creation are sent to a central data repository 215 as 
shown in figure 2D and as will be discussed with that figure. In the example of figure 
2 A, a first call data record 281 is created at a first call record creation point 291, and a 
second call data record 282 is created at a second call data creation point 292. 
5 Figure 2B is yet another drawing of the messaging system of the telephone or 

similar communication system as described in various representative embodiments of the 
present patent document. In addition to the elements shown in figure 2A, figure 2B 
shows calling station 105 connected to an initial signaling path segment 260 which is 
connected to an initial signaling transfer point 270 and which is connected in turn to the 

10 first signaling path segment 261. Also shown is called station 106 connected to a fifth 
signaling path segment 265 which is connected to a fourth signaling transfer point 274 
which is connected in turn to the fourth signaling path segment 264. Also as shown in 
figure 2B, a third call data record 283 is created at a third call data creation point 293. 
Further, in figure 2B the location routing number 297 corresponding to the called 

15 number T170 is obtained from a network element database 295 also referred to as a 
service control point database 295. 

Figure 2C is a flowchart for separation of call data records T100 in the telephone 
or similar communication system 100 as described in various representative 
embodiments of the present patent document. In block 298, the call data records T100 

20 are separated in time order by arrival time at the central data repository 215 of figure 2D. 
Block 298 then transfers control to block 299. 

In block 299 the separated groups of call data records T100 are sent to different 
processing units wherein parallel processing correlates the call data records T100. 
Parallel processing enables more rapid correlation. 



25 



3.3.4 Efficiency of Correlation: 

A critical factor in the performance of a correlating call detail records T100 is the 
reduction of the number of comparisons required to locate a candidate matching record 
T100 and then establish the confidence of matching. In a representative embodiment, 
since call records T100 arrive in approximately call release time at a central data base 
that is used to collect the system call detail records T100, they are ordered in time. Thus, 
22 
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they require minimal sorting to result in a fully ordered record sequence in call release 
time order. Sets of call detail records T100 can be grouped by time periods to enable 
parallel processing on a symmetric multiprocessing server. 

In another representative embodiment, call detail records T100 are separated into 

5 data streams according to the value of at least one digit in the called number T170. 
Typically the selected digit or digits are those rightmost in the number. As an example, 
if two digits are selected as the separation criteria, call data records for called number 
T170 312-465-6789 are separated first into the data stream identified by "89" in the 
called number T170. Note that in this example as many as 100 separate data streams 

1 0 could be created with resultant reduction in record T100 comparison time. The number 
of separations could also be selected to be less than 100 in this example. 

3.3.5 Correlation Summary: 

In the SS7 network 130, signaling path segments 260,261,262,263,264,265 
15 transport SS7 messages through signaling path segments 260,261,262,263,264 along 
with various parameters used though-out the call set up process to not only produce the 
desired connections, but also to enable all the switching offices involved to obtain 
measurements that can later be used to accurately bill the customers involved. 

20 3.3.6 Arbitrage Summary: 

The arbitrage detection methods as disclosed in representative embodiments 
comprise two techniques: (1) correlation and (2) statistical analysis. In the correlation 
process, call detail records T100 collected at the final leg of the call are correlated with 
call detail records T100 collected on earlier legs of the call, of which there may be 

25 numerous legs. Arbitrage is detected whenever a call initially directed to an 
interexchange carrier is later found to be delivered to the local exchange carrier via a 
means inconsistent with the delivery of interexchange traffic. In the statistical process, 
call detail records T100 between two carriers are collected and analyzed to characterize 
the traffic with respect to certain key parameters. Arbitrage is suspected when the 

30 characteristics match predefined patterns. 

Call detail records T100 can be collected using a variety of methods, including 

23 
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the use of a Link Monitoring System (LMS), such as Agilent Technologies' acceSS7 
system, although the basic elements of the present invention do not rely on a specific 
collection technique or specific vendor equipment. Link monitoring systems are designed 
to capture the SS7 call detail records T100 as described in Table 1. Measurement 
5 equipment is deployed at each of the signal transfer point 140 locations, and "listens" to 
the SS7 messages being transported over the SS7 links 135. 

Figure 2D is a drawing of a system for accumulating call detail records T100 into 
a central data repository 215, also referred to herein as a call detail record data base 215. 
Link monitoring systems detect the SS7 messages, timestamp them, and associate them 

10 into partial call detail records T100. At remote sites 205 processors consolidate partial 
call detail records T100 into complete call detail records T100, and forward the 
completed call detail records T100 in near real-time via a wide area network (WAN) 210 
to a central data repository 215, which could be for example a database that stores the 
call detail records T100. The call detail record database 215 is typically designed to 

1 5 store large quantities of call detail records T100 for extended periods of time. 

The quantity and breadth of information stored is dependent on the extent to 
which the link monitoring system (LMS) has been deployed on the carrier's network. 
In typical embodiments, it is sufficient to monitor all the SS7 links that provide 
interconnection between the local exchange carrier and other types of carriers, although 

20 additional coverage will provide more information that can be used to strengthen results 
of the analysis. 

4. Overview of Arbitrage Detection: 

Figure 2E is a flow chart of a representative method 250 for detection of arbitrage 
25 in the telephone or similar communication system 100 as described in various 
representative embodiments of the present patent document. In Block 220 of figure 2E, 
a first and second call records T100 are selected, wherein the first and second call 
records T100 both have the same called station 106. Block 220 then transfers control to 
block 225. 

30 Block 225 establishes whether the first and second call records T100 are 

correlated. Block 225 then transfers control to block 230. 
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When first and second call records T100 are correlated, block 230 transfers 
control to block 235. 

Block 235 establishes a measure of the probability of call mis-routing. 



5 5. Arbitrage Example: 

Figure 3A is a drawing of a representative example of call routing in the 
telephone or similar communication system 100 without arbitrage as described in various 
representative embodiments of the present patent document. In the representative 
example of figure 3 A, a call originates from the calling station 105 located in a first local 

1 0 access transport area (LATA 1)305, also referred to herein as a first remote area 305, to 
the called station 106 located in a second local access transport area (LATA 2) 306, also 
referred to herein as a second remote area 306. One call detail record T100 will be 
captured by a link monitoring system 310 for each leg of the call, assuming the link 
monitoring system 310 equipment is monitoring the appropriate SS7 links. In this 

1 5 example of a call originating in one part of the LEC network (LATA 1 305) and ending 
in another part of the network (LATA 2 306) could result in as many as 4 monitored call 
detail record's as follows: 



1. LEC eo 321 to LEC Tandem 322 in LATA 1 305 
20 2. LEC Tandem 322 in LATA 1 305 to IXC Tandem 323 in IXC network 

307 

3. IXC Tandem 323 in IXC network 307 to LEC Tandem 324 in LATA 

2 306 

4. LEC Tandem 324 to LEC Eo 325 in LATA 2 306 

25 

Note that the call is not monitored as it traverses the IXC network 307, because the IXC 
SS7 links are not part of the LEC network. In figure 3 A, LEC tdm 322 means LEC 
tandem 322, and LEC tdm 324 means LEC tandem 324. 

Figure 3B is a drawing of a representative example of call routing in the 
30 telephone or similar communication system 100 with arbitrage as described in various 
representative embodiments of the present patent document. In the representative 
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example of figure 3B, an arbitrage call is delivered at its destination via a competitive 
local exchange carrier (CLEC) 330, instead of being delivered via a local exchange 
carrier (LEC) tandem 324 in LATA2 306, as illustrated in figure 3A. 

The last leg of the call above, from the CLEC 330 to the LEC eo 325 in LATA 
5 2 306, could appear to be a simple originating call from a CLEC customer to a LEC 
customer. However, by matching this leg with one of the originating call legs (LEC eo 
321 to LEC tandem 322 or LEC tandem 322 to interexchange carrier 323) in the LATA 
1 305 area, it is possible to demonstrate that the final leg is really the continuation of an 
earlier call. 

10 Often the information needed to correlate the final call leg to prior call legs is 

missing or has been altered at some point. In representative embodiments, techniques 
are disclosed herein to effect recovery of sufficient information to allow the final call leg 
to be positively correlated with an earlier call leg, proving that the final call leg 
represents an improper routing of the original call. 

15 

6. Representative Methods for Detection of Arbitrage: 

In a representative embodiment, a basic approach to arbitrage detection is to 
correlate inbound calls from a competitive local exchange carrier (CLEC) to a local 
exchange carrier (LEC) with the corresponding outbound calls at their point of origin. 

20 The correlation feature of the link monitoring system (LMS) is the primary tool 

used to implement arbitrage detection. Call detail records (CDR's) T100 are collected 
throughout the LEC footprint and "correlated 1 at the time of their load into the call detail 
record database 215. The correlation method comprises identifying call segments via call 
detail records T100 wherein (1) the numbers dialed by the user (i.e., the called station 

25 numbers) T170 are identical and (2) initial address message (IAM) 150 timestamps T210 
and release message (REL) 165 timestamps T220 match within a configurable, but very 
small, time difference. The correlation method typically applies different time thresholds 
depending upon whether the call segments being correlated are deemed to be adjacent 
(e g. on either side of a tandem), or non-adjacent (e.g more than two tandems away from 

30 each other). 

Figure 4 is a flow chart of a method for correlating call detail records T100 as 
26 
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described in various representative embodiments of the present patent document. In 
block 405 a first call detail record 406, not shown in the figures but of form similar to 
that of Table 1 with time stamps of Table 2, of an inbound call from a first local access 
transport area 305 to a second local access transport area 306 is selected. Block 405 then 
5 transfers control to block 410. 

In block 410 a second call detail record 407, not shown in the figures but of form 
similar to that of Table 1 with time stamps of Table 2, of an inbound call from a first 
local access transport area 305 to a second local access transport area 306 is selected. 
Block 410 then transfers control to block 420. 
10 When the called station 106 of the first call detail record 406 is the same as the 

called station 106 of the second detail record 407, block 420 transfers control to block 
425. Otherwise, block 420 transfers control to block 440. 

When the absolute difference between the time stamp of the IAM of the first call 
detail record 406 subtracted from the time stamp of the IAM of the second call detail 
1 5 record 407 is less than a preselected initial address message (IAM) time difference 411, 
not shown in any of the figures and also referred to herein as a first time difference 411, 
block 425 transfers control to block 430. Otherwise, block 425 transfers control to block 
440. 

When the absolute difference between the time stamp of the REL of the first call 
20 detail record 406 subtracted from the time stamp of the REL of the second call detail 
record 407 is less than a preselected release message (REL) time difference 412, not 
shown in any of the figures and also referred to herein as a second time difference 412, 
block 430 transfers control to block 435. Otherwise, block 435 transfers control to block 
440. 

25 Block 435 marks the first and second call detail records 406,407 as correlated. 

The method above is typically repeated for other combinations of call detail records 
406,407. 

Block 440 marks the first and second call detail records 406,407 as uncorrected. 
Once again, the method above is typically repeated for other combinations of call detail 
30 records 406,407. 

Call detail records 406,407 are typically checked against the above method as 

27 
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they are loaded into the central data repository 215 and are assigned the same correlation 
identification code if they are correlated. Note that it is possible for more than two call 
detail records to be correlated and assigned a single correlation identification code. 

In order to eliminate false correlations (i.e., to disassociate call segments that 
5 really are not related to the same call), attempts are made to increase the correlation 
confidence by correlating other pieces of call setup information from the various call 
segments. Specifically, further efforts can be made to (1) identify ANM message time 
stamps that match within a configurable, but very small, time difference, (2) insuring that 
the Calling Number information parameters match, (3) insuring that Charge Number 
10 information parameters match, and/or (4) insuring that jurisdiction information 
parameters match. 

Figure 5 is a flow chart of additional method steps for correlating call detail 
records as described in various representative embodiments of the present patent 
document. The method steps of figure 5 are inserted between blocks 430 and 435 of 
1 5 figure 4. When the absolute difference between the time stamp of the ANM of the first 
call detail record 406 subtracted from the time stamp of the ANM of the second call 
detail record 407 is less than a preselected ANM time difference 413, not shown in any 
of the figures and also referred to herein as a third time difference 413, block 505 
transfers control to block 510. Otherwise, block 505 transfers control to block 440. 
20 When the calling number T110 of the first call detail record 406 is the same as 

the calling number T110 of the second call detail record 407, block 510 transfers control 
to block 515. Otherwise, block 505 transfers control to block 440. 

When the charge number of the first call detail record 406 is the same as the 
charge number of the second call detail record 407, block 515 transfers control to block 
25 520. Otherwise, block 515 transfers control to block 440. 

When the jurisdiction of the first call detail record 406 is the same as the 
jurisdiction of the second call detail record 407, block 520 transfers control to block 435. 
Otherwise, block 520 transfers control to block 440. 

Additional constraints can be applied to select calls that fit the criteria of 
30 arbitrage, and to exclude calls that may be correlated for other legitimate reasons or 
duplicate call segments that may have been collected due to over-provisioning of the link 

28 
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monitoring systems 310. Specifically, the following calls typically may be excluded: 
Calls inbound to the LEC network (non-transit, destined to a LEC telephone number) 
from CLECs in a given LATA that correlate with outbound calls to IXC's in a different 
LATA. The following calls are also typically excluded: (1) non-toll calls and special 
5 types of calls such as those that require a two step dialing process to complete, (2) 
duplicate call segments (same opc/dpc/tcic/iam, same call detail records, etc.), (3) local 
number portability calls which could represent legitimate routing with IXC delivering 
call to original CLEC number, and CLEC performing lookup and completing call to 
LEC, and (4) call forwarding calls where call forwarding takes place at the CLEC, and 
10 the resulting call to the LEC appears to have originated in another LATA. 

Several methods can be used to (a) jurisdictionalize call segments within LATA 
boundaries and to (b) identify outbound IXC calls and (c) identify non-transit inbound 
CLEC calls. 

Jurisdictionalization can be performed by (1) Using a look-up table based on the 

15 Local Exchange Routing Guide (LERG) to map the calling or called NPANXX to a 
specific State/LATA, (2) If the NPANXX is missing, assign a default NPANXX based 
on the point code of the switching system involved in the call, and then use a look up 
table based on the local exchange routing guide (LERG) to map the calling or called 
NPANXX to a specific state and/or LATA, and (3) reading the geographic identification 

20 contained within each call detail record T100 that identifies the point in the network 
where the call detail record T100 was collected, and use a look-up table to map this 
geographic location to a specific state and/or LATA. 

Identification of Outbound LEC to IXC Calls can be performed by (1) using a 
look-up table to map the specific trunk used on an originating LEC call derived from 

25 another look-Up table mapping the triplet of OPC, DPC and TCIC, which are available 
within the SS7 IAM message to a list of IXC trunks, (2) using the Transit Network 
Selection (TNS) or Carrier Identification Code (CIC) parameters contained within the 
SS7 IAM message to identify the requested IXC, and (3) using the destination point code 
(DPC) from the SS7 IAM message to identify calls routed to IXC's 

30 Identification of Non-transit Inbound from CLEC to LEC calls can be performed 

by (1) using a look-up table to map the specific trunk used on a terminating LEC call 
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(derived from another look-up table mapping the triplet of OPC, DPC and TCIC, which 
are available within the SS7 IAM message) to a list of CLEC and (2) using the 
origination point code (OPC) from the SS7 IAM message to identify calls originating 
from CLECs. 

5 

7. Statistical Analysis Methods: 

In representative embodiments, there are two typical approaches to arbitrage 
detection using statistical analysis: (1) single-carrier and (2) multi-carrier. 



10 7.1 Single Carrier: 

The basic approach to arbitrage detection using this statistical analysis method 
is to characterize the traffic between two carriers based upon the following criteria and 
compare the results to the following characteristics which are often present in known 
arbitrators: (1) Percentage of calls where forward or backward interworking bit 

1 5 T140,T150 is set which implies that the call traversed a non-SS7 network, (2) percentage 
of calls wherein calling party information is available, (3) percentage of calls terminating 
to the ILEC, (4) percentage of calls where jurisdiction indicator parameter is available, 
(5) percentage of calls where carrier identification code is available, and (6) number of 
NPA's associated with the Calling Party Information. 

20 Figure 6 is a flow chart of a method for establishing a probability of arbitrage in 

the telephone or similar communication system 100 as described in various 
representative embodiments of the present patent document. When the forward 
interworking parameter T140 is used to establish a measure of the probability of call mis- 
routing, block 610 transfers control to block 61 1 . Otherwise block 610 transfers control 

25 to block 620. 

In block 611, the percentage of calls wherein the forward interworking parameter 
T140 is set is established. Block 611 then transfers control to block 620. 

When the backward interworking parameter T150 is used to establish a measure 
of the probability of call mis-routing, block 620 transfers control to block 621. 

30 Otherwise block 620 transfers control to block 630. 

In block 621, the percentage of calls wherein the backward interworking 
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parameter T150 is set is established. Block 621 then transfers control to block 630. 

When calling station information Tl 10 availability is used to establish a measure 
of the probability of call mis-routing, block 630 transfers control to block 631. 
Otherwise block 630 transfers control to block 640. 
5 In block 631, the percentage of calls wherein availability of calling station 

information T110 is established. Block 631 then transfers control to block 640. 

When call ending in an ILEC 330 is used to establish a measure of the probability 
of call mis-routing, block 640 transfers control to block 641. Otherwise block 640 
transfers control to block 650. 
10 In block 641, the percentage of calls terminating in an independent local 

exchange carrier (ILEC) 330 is established. Block 641 then transfers control to block 
650. 

When jurisdiction indicator parameter information T130 availability is used to 
establish a measure of the probability of call mis-routing, block 650 transfers control to 
15 block 651. Otherwise block 650 transfers control to block 660. 

In block 651, the percentage of calls wherein availability of jurisdiction indicator 
parameter information T130 is established. Block 651 then transfers control to block 
660. 

When carrier identification parameter T160 availability is used to establish a 
20 measure of the probability of call mis-routing, block 660 transfers control to block 661 . 
Otherwise block 660 transfers control to block 670. 

In block 661, the percentage of calls wherein availability of carrier identification 
parameter T160 is established. Block 661 then transfers control to block 670. 

When calling station area code T110 is used to establish a measure of the 
25 probability of call mis-routing, block 670 transfers control to block 671. Otherwise 
block 670 transfers control to block 680. 

In block 671, the number of calling station area codes T110 is established.. 
Block 671 then transfers control to block 680. 

In block 680, the results of the above blocks are combined to obtain a measure 
30 of the probability of mis-routing of calls. 
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A measure of the probability of arbitrage is based upon the combinations of 
characteristics that are present. Once suspected, SS7 call detail records are randomly 
chosen and compared with billing records to confirm arbitrage. Once arbitrage is 
confirmed, the characteristics of known arbitrators can be further refined. 

5 

7.2 Multi-Carrier: 

The multi-carrier approach to arbitrage detection relies on the creation of "traffic 
profiles" associated with each of the interconnecting carriers. These traffic profiles 
contain historical traffic information including the daily, weekly and monthly amount of 
10 traffic; traffic distribution in both directions as a function of the hour of the day; traffic 
distribution by switching office and or by trunk groups, etc. 

Figure 7 is a flow chart of another method for establishing a probability of 
arbitrage in the telephone or similar communication system 100 as described in various 
representative embodiments of the present patent document. In block 710 a historical 
15 profile of first and second connecting carriers 330 is created, wherein first and second 
carriers 330 connect to the same local area exchange 325. Block 710 then transfers 
control to block 720. 

In block 720 the degree to which traffic profiles change inversely to each other 
is computed. Block 720 then transfers control to block 730. 
20 In block 730 a measure of probability of call mis-routing is established based on 

the results of block 720. 

Arbitrage may be suspected whenever the traffic profiles of two or more carriers 
change in ways inversely proportional to each other, suggesting the redirection of traffic 
from one carrier to another Once suspected, SS7 call detail records can be analyzed in 
25 further detail to confirm the arbitrage. 

8. Concluding Remarks: 

Previous methods for the determination of telephone traffic mis-routing have 
proven to be ineffective in determining the presence of arbitrage and to be often lacking 
30 in accuracy for billing purposes due in large part to limitations in the data that they use. 
Embodiments disclosed in the present patent document overcome these limitations by 
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collecting call detail records from various points in the telephone system, correlating 
these records, and then analyzing them. Such techniques have a greatly enhanced 
probability of probability of detecting arbitrage and billing accuracy. Call detail records 
T100 missing data can be enriched by data from related records T10 in the correlation 
5 process. 

While the present invention has been described in detail in relation to preferred 
embodiments thereof, the described embodiments have been presented by way of 
example and not by way of limitation. It will be understood by those skilled in the art 
that various changes may be made in the form and details of the described embodiments 
1 0 resulting in equivalent embodiment that remain within the scope of the appended claims. 
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What is claimed is: 



CLAIMS 



PATENT 



1. A computer operable method for correlating call data records in a 
2 telephone system, comprising the steps of: 

4 selecting a first and second call records, providing the call records 

comprise call characteristic information created in the telephone system 
6 and providing the call records identify same called station; and 

8 establishing whether first and second call records are correlated. 

2. A computer operable method as recited in claim 1, providing selected 
2 first and second call records arrive at a central data repository within a 

first time difference. 

3. A computer operable method as recited in claim 1, providing when an 
2 originating point code of first and second call records is used to establish 

whether the call records are correlated, wherein the originating point code 
4 identifies an origination signaling transfer point having capability of 

transferring call set-up messages between two signaling path segments, 
6 the method step for establishing whether the first and second call records 

are correlated comprises: 

8 

when the originating point codes of first and second call records are 
10 different, 

12 identifying first and second call records as uncorrelated; 

14 otherwise, 
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16 identifying first and second call records as correlated. 

4. A computer operable method as recited in claim 1, providing when a 
2 destination point code of first and second call records is used to establish 

whether the call records are correlated, wherein the destination point code 
4 identifies a destination signaling transfer point having capability of 

transferring call set-up messages between two signaling path segments, 
6 the method step for establishing whether the first and second call records 

are correlated comprises: 

8 

when the destination point codes of first and second call records are 
10 different, 

12 identifying first and second call records as uncorrelated; 

14 otherwise, 

16 identifying first and second call records as correlated. 

5. A computer operable method as recited in claim 1, providing first and 
2 second call data records are members of a group of call data records 

whose arrival at the central data repository was after a first preselected 
4 time and before a second preselected time. 

6. A computer operable method as recited in claim 1 , providing first and 
2 second call data records are members of a group of call data records 

whose called numbers have an identical value in at least one preselected 
4 digit position. 

7. A computer operable method as recited in claim 1, the method steps 
2 further comprising: 
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when the first and second data records are identified as correlated, 



4 

copying at least one data field from the first data record to the 
6 second data record. 

8. A computer operable method as recited in claim 1, the method steps 
2 further comprising: 

4 when the first and second data records are identified as correlated, 

6 copying at least one data field from the second data record to the 

first data record. 

9. A computer operable method as recited in claim 1, wherein the method 
2 step for establishing whether the first and second call records are 

correlated comprises: 

4 

subtracting a first timestamp included with the first call record from first 
6 timestamp included with the second call record, wherein first timestamp 

is time of a call initiation signal; 

8 

when the absolute value of the result of first timestamp subtraction 
10 method step is greater than a first preselected value, 

12 identifying first and second call records as uncorrected; 

14 otherwise, 

16 identifying first and second call records as correlated; and 

18 when first and second call records are identified as correlated and a 
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second timestamp included with first and second call records is used to 
20 establish correlation of first and second call records, 



22 subtracting the second timestamp of the first call record from the 

second timestamp of the second call record, wherein second 
24 timestamp is the time of a first party disconnect signal; and 

26 when the absolute value of the result of second timestamp 

subtraction method step is greater than a second preselected 
28 value, 

30 identifying first and second call records as uncorrelated. 

10. A computer operable method as recited in claim 1 , wherein the method 
2 step for establishing whether the first and second call records are 

correlated comprises: 

4 

when first and second call records are identified as correlated and a third 
6 timestamp included with first and second call records is used to establish 

correlation of first and second call records, 

8 

subtracting the third timestamp of the first call record from the 
10 third timestamp of the second call record, wherein third 

timestamp is the time of a call connect signal; and 

12 

when the absolute value of the result of third timestamp 
14 subtraction method step is greater than a third preselected value, 

16 identifying first and second call records as uncorrelated; 

1 8 when first and second call records are identified as correlated, the identity 
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of a calling station included in first and second call records is used to 
20 establish correlation of first and second call records, and when the call 

records identify different calling stations, 

22 

identifying first and second call records as uncorrelated; 

24 

when first and second call records are identified as correlated, the charge 
26 number of the calling station included in first and second call records is 

used to establish correlation of first and second call records, and when the 
28 call records identify different charge numbers, 

30 identifying first and second call records as uncorrelated; and 

32 when first and second call records are identified as correlated, the 

jurisdiction of the call included in first and second call records is used to 

34 establish correlation of first and second call records, and when the call 

records identify different jurisdictions, 

36 

identifying first and second call records as uncorrelated. 

11. A computer program storage medium readable by a computer, tangibly 
2 embodying a computer program of instructions executable by the 

computer to perform method steps for correlating call data records in a 
4 telephone system, the steps comprising: 

6 selecting a first and second call records, providing the call records 

comprise call characteristic information created in the telephone system 
8 and providing the call records identify same called station; and 

10 establishing whether first and second call records are correlated. 
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12. A computer program storage medium as recited in claim 11, wherein 
2 selected first and second call records arrive at a central data repository 

within a first time difference. 

13. A computer program storage medium as recited in claim 11, wherein 
2 when an originating point code of first and second call records is used to 

establish whether the call records are correlated, wherein the originating 
4 point code identifies an origination signaling transfer point having 

capability of transferring call set-up messages between two signaling path 
6 segments, the method step for establishing whether the first and second 

call records are correlated comprising: 

8 

when the originating point codes of first and second call records are 
10 different, 

12 identifying first and second call records as uncorrelated; 



identifying first and second call records as correlated. 

A computer program storage medium as recited in claim 1 1 , wherein 
when a destination point code of first and second call records is used to 
establish whether the call records are correlated, wherein the destination 
point code identifies a destination signaling transfer point having 
capability of transferring call set-up messages between two signaling path 
segments, the method step for establishing whether the first and second 
call records are correlated comprising: 

when the destination point codes of first and second call records are 
different, 
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identifying first and second call records as uncorrelated; 

12 

otherwise, 

14 

identifying first and second call records as correlated. 



15. A computer program storage medium as recited in claim 1 1 , wherein first 
2 and second call data records are members of a group of call data records 

whose arrival at the central data repository was after a first preselected 
4 time and before a second preselected time. 

1 6. A computer program storage medium as recited in claim 1 1 , wherein first 
2 and second call data records are members of a group of call data records 

whose called numbers have an identical value in at least one preselected 
4 digit position. 

17. A computer program storage medium as recited in claim 1 1 , the method 
2 steps further comprising: 

4 when the first and second data records are identified as correlated, 

6 copying at least one data field from the first data record to the 

second data record. 

18. A computer program storage medium as recited in claim 1 1 , the method 
2 steps further comprising: 

4 when the first and second data records are identified as correlated, 

6 copying at least one data field from the second data record to the 

first data record. 
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19. A computer program storage medium as recited in claim 1 1 , the step for 
2 establishing whether the first and second call records are correlated 

comprising: 

4 

subtracting a first timestamp included with the first call record from first 
6 timestamp included with the second call record, wherein first timestamp 

is time of a call initiation signal; 

8 

when the absolute value of the result of first timestamp subtraction 
10 method step is greater than a first preselected value, 

1 2 identifying first and second call records as uncorrected; 

14 otherwise, 

16 identifying first and second call records as correlated; and 

18 when first and second call records are identified as correlated and a 

second timestamp included with first and second call records is used to 
20 establish correlation of first and second call records, 

22 subtracting the second timestamp of the first call record from the 

second timestamp of the second call record, wherein second 
24 timestamp is the time of a first party disconnect signal; and 

26 when the absolute value of the result of second timestamp 

subtraction method step is greater than a second preselected 
28 value, 

30 identifying first and second call records as uncorrelated. 
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20. A computer program storage medium as recited in claim 1 1 , the step for 
establishing whether the first and second call records are correlated 
comprising: 

when first and second call records are identified as correlated and a third 
timestamp included with first and second call records is used to establish 
correlation of first and second call records, 

subtracting the third timestamp of the first call record from the 
third timestamp of the second call record, wherein third 
timestamp is the time of a call connect signal; and 

when the absolute value of the result of third timestamp 
subtraction method step is greater than a third preselected value, 

identifying first and second call records as uncorrelated; 

when first and second call records are identified as correlated, the identity 
of a calling station included in first and second call records is used to 
establish correlation of first and second call records, and when the call 
records identify different calling stations, 

identifying first and second call records as uncorrelated; 

when first and second call records are identified as correlated, the charge 
number of the calling station included in first and second call records is 
used to establish correlation of first and second call records, and when the 
call records identify different charge numbers, 

identifying first and second call records as uncorrelated; and 
42 
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when first and second call records are identified as correlated, the 
32 jurisdiction of the call included in first and second call records is used to 

establish correlation of first and second call records, and when the call 
34 records identify different jurisdictions, 

36 identifying first and second call records as uncorrelated. 
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ABSTRACT 
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Methods to correlate call data records in a telephone or other communication 
system. A combination of parameter values in the data records and timestamps 

5 associated with some of the parameters can be used for such correlation. The 
information available within a single call record has limitations due to the fact that 
critical routing information may be (a) missing or (b) incorrect. Correlation of call detail 
records obtained from various communication segments provides the ability to mutually 
enrich the records so as to increase billing accuracy, as well as to enhance the detection 

10 of call mis-routing and perform traffic analysis. 
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Message 


Parameter 


Description 


initial address message (IAM) 




INITIAL ADDRESS 
MESSAGE 




Originating Point 
Code (OPC) 


The SS7 node (e.g. switching 
office or STP) that is sending 
the message [T130] 




Destination Point 
Code 


The SS7 node (e.g switching 
office or STP) that the 
message is being sent to 
[T160f 




Calling Number 


The calling number of the 
user making the call [T110] 




Charge Number 


The charge number of the 
user making the call [T120] 




Called Number 


The number dialed by the 
user [T170] 




Carrier 

Indentification 
Code 


The IXC selected by the user 
(e.g. via 1010XXX) 




Forward 
Interworking 
Parameter 
[T140] 


. 

An indicator as to whether 
SS7 or non-SS7 interworking 
was encountered prior to this 
point in the call 


address complete message 
(ACM) F s 




ADDRESS COMPLETE 
MESSAGE 




OPC/DPC 


As above 




Backward 
Interworking 
Parameter 
[T150] 


An indicator as to whether 
00/ or non-00 / inter- 
working was encountered 
ahead of this point in the call 


answer message (ANM) 




ANSWER MESSAGE 




OPC/DPC 


As above 


release message (REL) 




KJiJL-tiAoii IVlbooALrL 




V / i V_ L J IV. 


As Above 




Release Cause 
Code 


An indication of the status of 
the call (e.g. answered, busy) 


(RLC) com P^ ete messa g e 




RELEASE COMPLETE 
MESSAGE 




OPC/DPC 


As above 


^ T100 


TABLE 1 
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initial address message (IAM) 
timestamp 
[T210] 


The time the trunk was seized 


address complete message (ACM) 
timestamp 


The time the called telephone began 
ringing 


answer message (ANM) timestamp 
[T230] 


The time the called telephone was 
answered 


release message (REL) timestamp 
[T220] 


The time the first of either the called or 
calling telephone was hung up. 


Release complete message (RLC) 
timestamp 


The time the second of the called or 
calling telephone was hung up. 



Table 2 
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